OpenChain AutomotiveWG Stat of OSS license tools(fossology, SW360 and SPDX Lite) with AGL release software

1. Copyright © 2020 DENSO TEN LIMITED. All rights reserved.
Yuichi Kusakabe
Open Source Program Office
DENSO TEN LIMITED
OpenChain AutomotiveWG
1
Stat of OSS license tools(fossology, SW360
and SPDX Lite) with AGL release software

2. Copyright © 2020 DENSO TEN LIMITED. All rights reserved.
About Myself
2
 Yuichi Kusakabe (DENSO TEN LIMITED)
 Software Engineer of IVI about 15 years
(for 16-bit and 64-bit architecture)
 Linux Software Engineer(2011-2013)
 Linux Software Lead Engineer(2013-Now)
 BSP Porting/Customizing
 Supporting for in-house software developers
 AGL(Automotive Grade Linux) Advisory Board member

3. Copyright © 2020 DENSO TEN LIMITED. All rights reserved. 3
OpenChain CES demo

4. Copyright © 2020 DENSO TEN LIMITED. All rights reserved. 4
Setup fossology / fossdriver
Download fossology docker image
$ docker pull fossology/fossology:3.6.0
Run fossology docker image
$ docker run -d -p 8081:80 --name fossology-3.6.0 fossology/fossology:3.6.0
Download fossdriver
$ git clone https://github.com/fossology/fossdriver.git
Install fossdriver
$ pip3 install -e /home/yocto/fossdriver
Setup fossology server
$ vi ~/.fossdriverrc
{
"serverUrl": "http://*.*.*.*:8081", <- Your PC fossology docker IP
"username": "fossy",
"password": "fossy"
}

5. Copyright © 2020 DENSO TEN LIMITED. All rights reserved. 5
Setup meta-spdxscanner and Run SPDX
Download meta-spdxscanner(AGL include meta-spdxscanner, Skip this download)
$ git clone https://github.com/dl9pf/meta-spdxscanner
Setup bblayers.conf
$ vi conf/bblayers.conf
BBLAYERS =+ " ¥
${METADIR}/external/meta-spdxscanner ¥
“
Setup local.conf
$ vi conf/local.conf
INHERIT += "fossdriver-host"
SPDX_DEPLOY_DIR = "/xxx/SPDX" <- Output SPDX file location(Full path)
Run bitbake SPDX
$ bitbake agl-demo-platform --runall=spdx # will generate all agl-demo-platform spdx
$ bitbake package_name -c spdx # will generate spdx of a specified package
Waiting, Waiting, Waiting(depend on Your PC spec)

6. Copyright © 2020 DENSO TEN LIMITED. All rights reserved. 6
SPDX file

7. Copyright © 2020 DENSO TEN LIMITED. All rights reserved. 7
Setup SW360 and SW360tools
Build SW360 and deploy SW360 docker image
https://github.com/eclipse/sw360
https://github.com/sw360/sw360chores
Run SW360 docker image
$ docker run --name image-name -d --privileged -p 8080:8080 -p 5984:5984 --
restart=always sw360:tagname /sbin/init
$ docker exec -it --user sw360 name /bin/bash
https://127.0.0.1:8080/

8. Copyright © 2020 DENSO TEN LIMITED. All rights reserved. 8
Setup SW360 and SW360tools
Download SW360tools
$ git clone https://github.com/eclipse/sw360

9. Copyright © 2020 DENSO TEN LIMITED. All rights reserved. 9
SW360tools Import/Export SPDX file
http://<host_ip>:8080/import

10. Copyright © 2020 DENSO TEN LIMITED. All rights reserved. 10
Import AGL SPDX file

11. Copyright © 2020 DENSO TEN LIMITED. All rights reserved. 11
Export AGL SPDX Lite file

12. Copyright © 2020 DENSO TEN LIMITED. All rights reserved. 12
AGL SPDX Lite file

13. Copyright © 2020 DENSO TEN LIMITED. All rights reserved. 13
Future work
 Step1
 Fix fossology scan error
 Deploy AGL SW360 docker image include AGL SPDX file
-> Very easy for anyone to use OSS license tools(fossology and
SW360)
 Step2
 Improve SW360 import SPDX file time
 Improve SW360 export SPDX Lite file time
 StepX
 How to share common OSS license screening result?

14. Copyright © 2020 DENSO TEN LIMITED. All rights reserved. 14
Thank you!!!
yuichi.kusakabe@denso-ten.com